PT-2021-22781

CVE-2021-39941

Published

2021-12-13

Updated

2024-03-06

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.0 to 14.3.6 GitLab CE/EE versions 14.4 to 14.4.4 GitLab CE/EE versions 14.5 to 14.5.2

Description An information disclosure issue allowed non-project members to see the default branch name for projects that restrict access to the repository to project members.

Recommendations For versions 12.0 to 14.3.6, update to a version outside of this range to resolve the issue. For versions 14.4 to 14.4.4, update to a version outside of this range to resolve the issue. For versions 14.5 to 14.5.2, update to a version outside of this range to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Ashish

Ashish_R_Padelkar

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers

CVE-2021-39941